11 October 2026, 10:11Виталий Лещенко

Networking for beginners. Part 5: IPv4 — addresses, masks and subnets

All parts of the series “Networking for beginners”

The previous four parts were about the link layer: Ethernet, Wi-Fi and PPPoE can deliver a frame to a neighbour — a device on the same cable, in the same radio network, at the other end of the same line. The link layer cannot see beyond the neighbour: a MAC address says nothing about where a machine is, and you cannot build a switch with a billion addresses in its table.

The network layer adds two things: an address that tells you where a machine is, and routing — passing a packet from network to network through a chain of routers. The network-layer protocol of the internet is IP, the Internet Protocol, and its fourth version, IPv4 (RFC 791, 1981), still carries most of the traffic. Today is only about addresses: how they are structured, how subnets are calculated and how a machine makes its first decision based on an address. The packet header, routing and NAT are in the next part.

The address: 32 bits

An IPv4 address is a 32-bit number. For humans it is written as four decimal numbers from 0 to 255 separated by dots, one byte per number:

192.168.1.10
  │   │ │  └─ 00001010
  │   │ └──── 00000001
  │   └────── 10101000
  └────────── 11000000

11000000.10101000.00000001.00001010

There are 2³² = 4,294,967,296 addresses in total. That number seemed huge in 1981 and ran out by 2011; more on that at the end.

An address belongs not to a machine but to an interface: a laptop with a cable and Wi-Fi has two addresses, a router has an address for each network it is connected to, and everyone also has the address 127.0.0.1. A single interface can have several addresses too.

The mask: where the network ends and the host begins

An address consists of two parts: the network number in the high-order bits and the host number in the low-order bits. Where the boundary lies is defined by the mask: 32 bits with ones opposite the network part and zeros opposite the host part. The ones always run contiguously from the left, so a mask can be described by a single number — the count of ones. That is the slash notation, the prefix:

address 192.168.1.10      11000000.10101000.00000001.00001010
mask    255.255.255.0     11111111.11111111.11111111.00000000   = /24
                          └─────── network ─────────┘└ host ┘

192.168.1.10/24 and "address 192.168.1.10, mask 255.255.255.0" are the same thing. The first 24 bits are the network 192.168.1, the last 8 are host number 10 in it.

Three things are computed from the address and the mask, all three with bitwise operations:

The network address: address AND mask. All host bits are zeroed: 192.168.1.0. This address denotes the network as a whole and is not assigned to a host.
The broadcast address: address OR inverted mask. All host bits are ones: 192.168.1.255. A packet sent to it is received by every host on the network (in an Ethernet frame it goes to ff:ff:ff:ff:ff:ff).
The host range: everything in between, 192.168.1.1–192.168.1.254. 2⁸ − 2 = 254 in total.

Two are always subtracted: the first address is the network, the last is broadcast. The formula for the number of hosts is 2^(32 − prefix) − 2.

Let's take an example where the boundary does not fall on a byte, otherwise the arithmetic looks simpler than it is. The address 192.168.1.130/26:

address 192.168.1.130     11000000.10101000.00000001.10000010
mask    /26               11111111.11111111.11111111.11000000   = 255.255.255.192
                                                     └┘└────┘
                                                    net   host (6 bits)
network   address AND mask                  ...00000001.10000000  = 192.168.1.128
broadcast address OR NOT mask               ...00000001.10111111  = 192.168.1.191
hosts     192.168.1.129 – 192.168.1.190, total 2⁶ − 2 = 62

In the last byte of the mask, 11000000, the two high-order bits belong to the network, and they divide the range 0–255 into four blocks of 64: .0–.63, .64–.127, .128–.191, .192–.255. The address .130 falls into the third one. A trick for mental arithmetic: block size = 256 − the last non-zero byte of the mask. For 255.255.255.192 it is 64, for .224 32, for .240 16.

A table for the last byte that covers ninety percent of cases:

Prefix	Mask	Hosts	Used for
/24	255.255.255.0	254	a typical local network
/25	255.255.255.128	126
/26	255.255.255.192	62
/27	255.255.255.224	30
/28	255.255.255.240	14	a small server subnet
/29	255.255.255.248	6	an address block from an ISP
/30	255.255.255.252	2	a link between two routers
/31	255.255.255.254	2	a link between routers without network and broadcast addresses (RFC 3021)
/32	255.255.255.255	1	a single address: loopback, VIP, a host route

Two special cases. /31 breaks the "minus two" rule: on a link between two routers neither the network address nor broadcast is needed, and the standard allowed both addresses to be used. /32 is not a network but a single address; it is how you write an address that must be on an interface but does not belong to any segment: a router's loopback interface address, a service's virtual address.

On the other side of the byte the logic is the same: 10.0.0.0/8 is 16 million addresses, 172.16.0.0/12 a million, 192.168.0.0/16 65 thousand. The prefix /0 with mask 0.0.0.0 covers all addresses whatsoever; we will meet 0.0.0.0/0 in the next part as the "default route".

Splitting and merging

A prefix is just the position of the boundary, and it can be moved. Moving it right by one bit splits a network in half:

192.168.1.0/24   (256 addresses)
├── 192.168.1.0/25     (.0 – .127)
│   ├── 192.168.1.0/26     (.0 – .63)
│   └── 192.168.1.64/26    (.64 – .127)
└── 192.168.1.128/25   (.128 – .255)
    ├── 192.168.1.128/27   (.128 – .159)
    ├── 192.168.1.160/27   (.160 – .191)
    └── 192.168.1.192/26   (.192 – .255)

The parts do not have to be equal: on the right there is one /26 and two /27s. This is called VLSM (variable-length subnet masks), and that is exactly how address space is carved up in real networks: /26 for servers, /28 for printers, /30 for links between routers.

Moving it left merges. The networks 192.168.0.0/24 and 192.168.1.0/24 differ only in the 24th bit, and together they are 192.168.0.0/23. This is aggregation (summarisation), and the internet rests on it: an ISP's router does not store millions of routes to every /24; it stores one entry for a customer's whole block. Only aligned blocks can be merged: 192.168.1.0/24 and 192.168.2.0/24 will not combine into a /23, because 192.168.1.0/23 is .0 and .1, while 192.168.2.0/23 is .2 and .3. The check is simple: the network address must be divisible by the block size.

The tool to avoid doing it by hand is ipcalc:

$ ipcalc 192.168.1.130/26
Address:   192.168.1.130        11000000.10101000.00000001.10 000010
Netmask:   255.255.255.192 = 26 11111111.11111111.11111111.11 000000
Wildcard:  0.0.0.63             00000000.00000000.00000000.00 111111
=>
Network:   192.168.1.128/26     11000000.10101000.00000001.10 000000
HostMin:   192.168.1.129        11000000.10101000.00000001.10 000001
HostMax:   192.168.1.190        11000000.10101000.00000001.10 111110
Broadcast: 192.168.1.191        11000000.10101000.00000001.10 111111
Hosts/Net: 62

The first decision: neighbour or gateway

Now the most important use of the mask. A host has a packet for address X. The link layer can only deliver to a neighbour. How does the host find out whether X is a neighbour?

The algorithm:

Take the destination address X and apply its own mask to it: X AND mask.
Compare the result with the address of its own network.
A match — X is on the same network, so it is a neighbour: send the frame directly to it (its MAC address is learned via ARP, part 7).
No match — X is somewhere outside the segment: send the frame to the default gateway, a router whose address the host was given during configuration. From there it is the router's problem.

Host 192.168.1.10/24, gateway 192.168.1.1:

Destination	AND 255.255.255.0	My network?	The frame goes
`192.168.1.20`	`192.168.1.0`	yes	to the MAC of host `.20`
`192.168.1.255`	`192.168.1.0`	yes	to `ff:ff:ff:ff:ff:ff`
`192.168.2.5`	`192.168.2.0`	no	to the MAC of gateway `192.168.1.1`
`203.0.113.10`	`203.0.113.0`	no	to the gateway's MAC

Two consequences follow, and they explain most cases of "the network is configured but doesn't work":

The gateway must be on the same network as the host. Otherwise the host, by its own algorithm, will decide that it needs a gateway to reach the gateway. Linux simply will not accept such a configuration: ip route add default via 192.168.2.1 with the address 192.168.1.10/24 will reply "Nexthop has invalid gateway".

A wrong mask breaks connectivity unpredictably. Say host A has 192.168.1.10/24, while B by mistake has 192.168.1.20/25. A considers B a neighbour and sends the frame directly — it arrives. To reply, B applies its own /25 mask: 192.168.1.10 AND 255.255.255.128 = 192.168.1.0, its network is 192.168.1.0/25 — also a neighbour, it replies directly. It works. But host C is 192.168.1.200/24: A sees it as a neighbour, but B does not, and sends its reply to the gateway. If the gateway is smart enough to send the packet back into the same segment, it works, but slowly and through the router; if not, A can ping B, C can ping A, but B cannot reach C. Networks like this live for years until someone looks at the masks.

Classes: history that still gets in the way

Until 1993 the mask was not configured but followed from the first bits of the address:

Class	First bits	Range	Mask	Networks × hosts
A	`0`	0.0.0.0 – 127.255.255.255	/8	128 × 16M
B	`10`	128.0.0.0 – 191.255.255.255	/16	16K × 65K
C	`110`	192.0.0.0 – 223.255.255.255	/24	2M × 254
D	`1110`	224.0.0.0 – 239.255.255.255	—	multicast addresses
E	`1111`	240.0.0.0 – 255.255.255.255	—	reserved

The scheme turned out to be wasteful: a class C was not enough for an organisation with 300 computers, while a class B with 65 thousand was too large, and addresses in it went to waste. In 1993 CIDR (Classless Inter-Domain Routing) was introduced: a mask of arbitrary length, written as a prefix, with routes aggregated. Everything earlier in this article is CIDR.

Classes, however, have not disappeared from the minds of tools. ifconfig and some Windows utilities, given an address without a mask, still substitute the classful one; "a class C network" in conversation simply means a /24; and classes D and E have remained as they were.

Addresses that do not travel the internet

Not all of the address space is handed out. Ranges you should recognise at a glance:

Range	What it is
`0.0.0.0/8`	"this host, this network". `0.0.0.0` in a list of listening ports means "all the machine's addresses", in an address request "I don't have one yet" (we saw this in IPCP in the fourth part, and will see it in DHCP)
`127.0.0.0/8`	loopback: a packet sent to any of these addresses comes back to the same machine without leaving it; `127.0.0.1` is `localhost`
`169.254.0.0/16`	link-local: a host assigns itself a random address from here if nobody gave it one (Windows calls this APIPA). If you see such an address, the DHCP server did not respond
`10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`	private (RFC 1918). Anyone can use them inside their own network; internet routers do not route them. To reach the internet from such an address you need NAT (part 6)
`100.64.0.0/10`	addresses for CGNAT: an ISP hands them to subscribers when it lacks enough public addresses of its own and translates them on its side (part 6)
`224.0.0.0/4`	multicast: a packet to such an address is received by everyone subscribed. `224.0.0.1` is all hosts on the segment, `224.0.0.251` is mDNS
`240.0.0.0/4`	reserved since 1981 and still unused
`255.255.255.255`	limited broadcast: to everyone on this segment; it does not pass through a router
`192.0.2.0/24`, `198.51.100.0/24`, `203.0.113.0/24`	documentation: for examples in articles and books, not routed on the internet. These are the ones used in this series' examples

Everything else is public addresses, unique across the whole internet. They are handed out in blocks by five regional registries (RIPE NCC for Europe, ARIN for North America, etc.) to ISPs and large organisations, and by ISPs to subscribers.

Why we ran out of addresses

From 4.3 billion addresses subtract private, multicast, the reserved class E, loopback — about 3.7 billion remain. There are eight billion people on the planet, each with several devices. IANA's central pool ran out in February 2011, the regional ones between 2011 and 2019. Today a new block can only be bought on the secondary market, for several tens of dollars per address.

That is why a home router gets a single public address from the ISP (and increasingly an address from 100.64.0.0/10), hands out private 192.168.x.x addresses to devices and swaps addresses on the fly. That is NAT, and it is covered in the next part together with the header and routing. The final answer to the shortage is IPv6 with its 2¹²⁸ addresses, to which a separate block of the series is devoted.

Seeing it for yourself

Interface addresses and masks:

$ ip -4 addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 ...
    inet 127.0.0.1/8 scope host lo
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 ...
    inet 192.168.1.10/24 brd 192.168.1.255 scope global dynamic eth0

scope host — the address is visible only inside the machine, scope global — an ordinary one, dynamic — obtained automatically, brd — the computed broadcast address.

The routing table is what the "neighbour or gateway" decision is based on. Without details for now; they are in the next part:

$ ip route
default via 192.168.1.1 dev eth0
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.10

The second line appeared by itself (proto kernel) when the interface was assigned an address with a mask: "network 192.168.1.0/24 is directly behind eth0". The first is the default gateway.

To ask the system how it will send a packet to a specific address:

$ ip route get 192.168.1.20
192.168.1.20 dev eth0 src 192.168.1.10 uid 1000

$ ip route get 203.0.113.10
203.0.113.10 via 192.168.1.1 dev eth0 src 192.168.1.10 uid 1000

In the first case there is no via — a neighbour; in the second there is — through the gateway. This is the very algorithm from the middle of the article, executed by the kernel.

And on Windows it is the same: ipconfig shows the address, mask and gateway, route print the routing table.

Key takeaways

An IPv4 address is 32 bits; the mask separates the network number from the host number; /24 and 255.255.255.0 are the same thing.
The network address is AND with the mask, the broadcast address is OR with the inverted mask, the number of hosts is 2^(32 − prefix) − 2. The block size in the last byte is 256 minus the mask byte.
Subnets are split by moving the boundary right and merged by moving it left, but only aligned blocks.
A host compares the destination address with its own network using its own mask: a match means a neighbour, otherwise the gateway. The gateway must be on the same network. A wrong mask breaks connectivity partially and invisibly.
The private ranges 10/8, 172.16/12, 192.168/16 are not routed on the internet; 169.254.x.x means "no address obtained"; 127.x.x.x is the machine itself.

Next — Part 6: IPv4 — header, routing and NAT: the packet header field by field, what TTL is and why it is needed, how a router chooses a route by the longest prefix, what happens to a packet that does not fit in a frame, and how NAT works — the reason your whole flat sits behind one address.